5 ms·

What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.

by 201984 13d ago

limagnolia 13d ago
The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.
- 201984 13d ago
  How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
  - jerkstate 13d ago
    what good is a phone if it isn't on a network?
    - cpburns2009 13d ago
      Have you ever been in a large building with awful cell reception and no wifi access?
    - cesarb 13d ago
      > what good is a phone if it isn't on a network? 1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan. 2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
  - deleted 13d ago
    [deleted]
  - roryirvine 13d ago
    If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
    - stonogo 13d ago
      Poor people exist.
      - roryirvine 13d ago
        The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
        arcfour 13d ago
        I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
        rcxdude 13d ago
        They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
        kps 13d ago
        > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
        stonogo 13d ago
        I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
  - Yokolos 13d ago
    Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on. I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token. Seems a lot safer to me than using my login credentials on a potentially unsafe device.
    - limagnolia 13d ago
      Yes, this is how it could work, or it could display a code you type into your phone.
  - jon-wood 13d ago
    There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
    - thwarted 13d ago
      I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
      - sgerenser 13d ago
        See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
      - LocalPCGuy 13d ago
        The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
    - sgerenser 13d ago
      AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
      - sgerenser 13d ago
        Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.
- alienbaby 13d ago
  That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
- RHSeeger 13d ago
  The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys. When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
  - judge2020 13d ago
    They're talking about a web-based QR code solution separate from passkeys. Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
- wpollock 13d ago
  > The website should display a qr code you can scan with your phone that allows you to then login... A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve. I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem. Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt) For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint). (Not affiliated with Keepass, just a happy longtime user.)
  - LocalPCGuy 13d ago
    That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec). Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
  - Ferret7446 13d ago
    The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
  - dwaite 12d ago
    Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel. That means attackers need more than to display a QR code, they also need a local presence (radio).
xp84 13d ago
My suggestion would be to not do that. But keep a password and an offline TOTP app if you must. It’s still an option.
judge2020 13d ago
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.
- cesarb 13d ago
  > > What if the computer you want to log in on doesn't have Bluetooth? > Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. What if the computer you want to log in on doesn't have a WiFi chip? It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
  - RHSeeger 13d ago
    The computer I just replaced had neither wifi nor bluetooth. It was a desktop device and had no use for either.
- reaperducer 13d ago
  Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. That's a technocratic reply, not one that is useful in the real world. As noted by the person you're replying to, it's not his computer. It's a public library. Most computers in non-residential settings will have various features locked down, including Bluetooth. Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.

What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.

by 201984 13d ago

What if the computer you want to log in on doesn't have Bluetooth? Probably most public computers (like ones in libraries) don't have it.

limagnolia 13d ago

The website should display a qr code you can scan with your phone that allows you to then login, unfortunately a lot of sites don't implement this, and some don't implement backup codes. This isn't the fault of passkeys per se, but of poor implementations.

201984 13d ago
How does scanning the barcode with your phone log you into the computer? Does your phone need network access for that?
- jerkstate 13d ago
  what good is a phone if it isn't on a network?
  - cpburns2009 13d ago
    Have you ever been in a large building with awful cell reception and no wifi access?
  - cesarb 13d ago
    > what good is a phone if it isn't on a network? 1. It might be on a voice network but not on a data network; for instance, if you don't have a data plan. 2. Modern smartphones are actually a hybrid of a traditional cell phone and a traditional PDA, and you might be using it for the PDA part.
- deleted 13d ago
  [deleted]
- roryirvine 13d ago
  If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?
  - stonogo 13d ago
    Poor people exist.
    - roryirvine 13d ago
      The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. The number of people sharing GP's concerns for reasons of poverty rather than because of their personal security posture will be vanishingly small.
      - arcfour 13d ago
        I'll have to remember this one the next time I hear the phone/poverty argument made in bad faith.
      - rcxdude 13d ago
        They still exist, though. And in my experience people in vulnerable positions have somewhere between zero and one phones at any given time, without necessarily any good continuity between them.
      - kps 13d ago
        > The poorest country I'm familiar with is Zambia, where about 90% of the population have a mobile subscription. Only 85%¹ of the population are over the age of 4. Smart kids they've got. ¹ https://populationpyramids.org/zambia https://populationpyramids.org/zambia
      - stonogo 13d ago
        I don't think "fuck 10% of the population" is as strong an argument as you seem to think it is.
- Yokolos 13d ago
  Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on. I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token. Seems a lot safer to me than using my login credentials on a potentially unsafe device.
  - limagnolia 13d ago
    Yes, this is how it could work, or it could display a code you type into your phone.
- jon-wood 13d ago
  There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.
  - thwarted 13d ago
    I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.
    - sgerenser 13d ago
      See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.
    - LocalPCGuy 13d ago
      The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.
  - sgerenser 13d ago
    AFAIK, the "scan this QR code" method of signing in with a passkey on a phone on a device w/o the passkey requires Bluetooth. There's some type of handshaking that goes on in order for you to prove you're in physical proximity of the device you are logging in on, to prevent phishing attacks.
    - sgerenser 13d ago
      Since I might have made someone mad... to clarify, as I understand it, Bluetooth is absolutely required for this "Scan the QR code" flow to work. However, it's also possible the actual authentication traffic to travel over a different pathway (wifi, cellular), but the bluetooth part is always required though to prove proximity. So on e.g. a library computer without Bluetooth enabled, you would not be able to log in with a passkey on your phone.
alienbaby 13d ago
That's still a terrible solution. Plenty of people don't have phones that can do that, or dont have e it with them when they do etc..
RHSeeger 13d ago
The fact that nearly every passkey implementation is lacking in a variety of very impactful ways... is a very good reason to _not_ use passkeys. When every passkey interaction is a different variety of user interaction nightmare, it's not very convincing that it's a good idea in the first place
- judge2020 13d ago
  They're talking about a web-based QR code solution separate from passkeys. Passkey QR codes are only WebAuthn via CTAP hybrid transport (with BLE verified proximity)
wpollock 13d ago
> The website should display a qr code you can scan with your phone that allows you to then login... A malicious website can display a QR code too. I think this "feature" could cause some of the security issues that passkesys were intended to solve. I use Keepass and the free tier of Dropbox, to keep my passwords strong and available across multiple devices. (Dropbox not required, you can store the database on a thumb drive.) Backups are no problem. Keepass (or KeepassXC) stores other data as well, including the correct URLs for sites. So my workflow is simply to click the URL from within Keepass, copy the username and password, and paste them into the login screen. So easy even an adult can do it! (Humor attempt) For convenience, Keepass database can be unlocked with either a password or biometrics (your fingerprint). (Not affiliated with Keepass, just a happy longtime user.)
- LocalPCGuy 13d ago
  That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec). Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)
- Ferret7446 13d ago
  The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.
- dwaite 12d ago
  Yes, the passkey flow QR code contains a public key, and a local key exchange is done over bluetooth to prove proximity. That is used to set up a confidential channel. That means attackers need more than to display a QR code, they also need a local presence (radio).

xp84 13d ago

My suggestion would be to not do that. But keep a password and an offline TOTP app if you must. It’s still an option.

judge2020 13d ago

Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms.

cesarb 13d ago
> > What if the computer you want to log in on doesn't have Bluetooth? > Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. What if the computer you want to log in on doesn't have a WiFi chip? It doesn't have to be an old computer; for instance, the desktop computer I built last year uses a wired gigabit Ethernet connection to the router right next to it, and doesn't have (or need) any WiFi or Bluetooth chip.
- RHSeeger 13d ago
  The computer I just replaced had neither wifi nor bluetooth. It was a desktop device and had no use for either.
reaperducer 13d ago
Only if they’re a bit old. Nowadays WiFi chips double as Bluetooth chips on newer platforms. That's a technocratic reply, not one that is useful in the real world. As noted by the person you're replying to, it's not his computer. It's a public library. Most computers in non-residential settings will have various features locked down, including Bluetooth. Hotels, clubs, airport lounges, various government facilities… there are thousands of places where you might really need to use a computer but don't control the technology.